Systems and methods for dynamically managing data sets

ABSTRACT

Systems and methods of monitoring for anomalous data records. The system conducts a method including: receiving a data record associated with at least one meta attribute to determine whether subsequent processing of the data record is warranted; generating an anomaly prediction for the data record based on a detection model and the at least one meta attribute associated with the data record, the detection model defined by a plurality of score distribution representations based on quantile bins and a dynamic quantile weight for providing an interim anomaly measure corresponding to respective score distribution representations, wherein the anomaly prediction is generated based on a combination of interim anomaly measures associated with respective meta attributes associated with the data record; and transmitting a signal representing the anomaly prediction for presentation at a user device for identifying one or more data records for subsequent data processes.

CROSS REFERENCE TO RELATED APPLICATIONS

This application claims priority from U.S. provisional patentapplication No. 62/949,781, entitled “SYSTEMS AND METHODS FORDYNAMICALLY MANAGING DATA SETS”, filed on Dec. 18, 2019, the entirecontents of which are hereby incorporated by reference herein.

FIELD

Embodiments of the present disclosure generally relate to monitoringdata records, and in particular to systems and methods of monitoring foranomalous data records in a plurality of data records.

BACKGROUND

Data management servers may be configured to receive volumes of datasetsfrom a plurality of data sources and may conduct operations formonitoring data records of the datasets. Operations for monitoring datarecords may be based on one or a plurality of criteria.

SUMMARY

In one aspect, the present disclosure provides a system of monitoringfor anomalous data records in a plurality of data records. The systemincludes a processor and a memory coupled to the processor. The memorymay store processor-executable instructions that, when executed, mayconfigure the processor to: receive a data record associated with atleast one meta attribute to determine whether subsequent processing ofthe data record is warranted; generate an anomaly prediction for thedata record based on a detection model and the at least one metaattribute associated with the data record, the detection model definedby a plurality of score distribution representations based on quantilebins and a dynamic quantile weight for providing an interim anomalymeasure corresponding to respective score distribution representations,wherein the anomaly prediction is generated based on a combination ofinterim anomaly measures associated with respective meta attributesassociated with the data record; and transmit a signal representing theanomaly prediction for presentation at a user device for identifying oneor more data records for subsequent data processes.

In another aspect, the present disclosure provides a method ofmonitoring for anomalous data records in a plurality of data records.The method may include: receiving a data record associated with at leastone meta attribute to determine whether subsequent processing of thedata record is warranted; generating an anomaly prediction for the datarecord based on a detection model and the at least one meta attributeassociated with the data record, the detection model defined by aplurality of score distribution representations based on quantile binsand a dynamic quantile weight for providing an interim anomaly measurecorresponding to respective score distribution representations, whereinthe anomaly prediction is generated based on a combination of interimanomaly measures associated with respective meta attributes associatedwith the data record; and transmitting a signal representing the anomalyprediction for presentation at a user device for identifying one or moredata records for subsequent data processes.

In another aspect, a non-transitory computer-readable medium or mediahaving stored thereon machine interpretable instructions which, whenexecuted by a processor may cause the processor to perform one or moremethods described herein.

In various further aspects, the disclosure provides correspondingsystems and devices, and logic structures such as machine-executablecoded instruction sets for implementing such systems, devices, andmethods.

In this respect, before explaining at least one embodiment in detail, itis to be understood that the embodiments are not limited in applicationto the details of construction and to the arrangements of the componentsset forth in the following description or illustrated in the drawings.Also, it is to be understood that the phraseology and terminologyemployed herein are for the purpose of description and should not beregarded as limiting.

Many further features and combinations thereof concerning embodimentsdescribed herein will appear to those skilled in the art following areading of the present disclosure.

DESCRIPTION OF THE FIGURES

In the figures, embodiments are illustrated by way of example. It is tobe expressly understood that the description and figures are only forthe purpose of illustration and as an aid to understanding.

Embodiments will now be described, by way of example only, withreference to the attached figures, wherein in the figures:

FIG. 1 illustrates a system, in accordance with an embodiment of thepresent disclosure;

FIGS. 2A and 2B illustrate metric distribution representations, inaccordance with embodiments of the present disclosure;

FIGS. 3A and 3B illustrate score distribution representations, inaccordance with embodiments of the present disclosure;

FIGS. 4A and 4B illustrate a logarithmic transformed metric distributionrepresentation and a score distribution representation, respectively, inaccordance with embodiments of the present disclosure;

FIG. 5 illustrates a score distribution representation, in accordancewith another embodiment of the present disclosure;

FIG. 6 illustrates a method of monitoring for anomalous data records ina plurality of data records, in accordance with an embodiment of thepresent disclosure; and

FIG. 7 illustrates a user interface configured to display summary dataassociated with anomaly predictions, in accordance with embodiments ofthe present disclosure.

DETAILED DESCRIPTION

Embodiments of systems and methods of monitoring for anomalous datarecords based on detection models are described present disclosure. Insome embodiments, datasets may include a plurality of data records. Insome examples, data records may include journal entries recordingresource transfers. A resource transfer may be associated with atransfer of monetary funds, digital assets, tokens, precious materials,or other types of resources. Other types of datasets and data recordshaving data structures for capturing other types of data may becontemplated.

In some scenarios, a data record may include data values associated witha resource transfer (e.g., monetary transaction between a sender deviceand a receiver device). The data record may include data valuesassociated with a user identifier, an organizational title or positionof a user (e.g., department vice president, manager, employee, etc.),date of resource transfer, or textual description of the resourcetransfer, among other examples. As the data record may be based on auser inputting data values via a client device, for ease of exposition,data records may be described as “manual journal entries”.

To illustrate features of embodiments disclosed herein, manual journalentries may be for tracking resource transfers at a banking institution.Systems may retrieve or receive data records from systems storinggeneral ledgers, human resources data, data for foreign exchangetransactions, or other systems storing data associated withtransactions. Prior to finalizing a resource transfer between the senderdevice and the receiver device, in some scenarios, an approver user mayreview manual journal entries via a client device and, if approved, theclient device may receive an approval signal from the approver user(e.g., clicking a user interface button), such that the manual journalentries may be promoted or otherwise advanced to a subsequent resourcetransfer stage.

In some scenarios, such approval or promotion operations of manualjournal entries may be discretionary or may be based on operations thatmay not ensure an appropriate level of data record scrutiny prior toapproval. It may be beneficial to provide systems and methods ofmonitoring for anomalous data records, thereby increasing the chance orconfidence that approval or promotion of manual journal entries adhereto policies associated with data record accuracy, data recordcompleteness, or data record adherence to organizational policies. Forexample, it may be beneficial to provide systems and methods foridentifying outlier data records based on detection models generated bydatasets from a prior points in time.

Reference is made to FIG. 1 , which illustrates a system 100, inaccordance with an embodiment of the present disclosure. The system 100may transmit or receive data messages via a network 150 to/from a clientdevice 130 or one or more data source devices 160. While one clientdevice 130 and one data source device 160 is illustrated in FIG. 1 , itmay be understood that any number of client devices or data sourcedevices may transmit or receive data messages to or from the system 100.

The network 150 may include a wired or wireless wide area network (WAN),local area network (LAN), a combination thereof, or other networks forcarrying telecommunication signals. In some embodiments, networkcommunications may be based on HTTP post requests or TCP connections.Other network communication operations or protocols may be contemplated.

The system 100 includes a processor 102 configured to implementprocessor-readable instructions that, when executed, configure theprocessor 102 to conduct operations described herein. For example, thesystem 100 may be configured to conduct operations for receiving volumesof datasets from one or more data source devices and generating outlieror anomaly detection models based on the volumes of datasets. Thevolumes of datasets may include data records such as journal entriesassociated with resource transfers. Examples of resources may includemonetary funds, digital assets, tokens, precious metals, or other typesof resources.

In some embodiments, the generated anomaly detection models may be basedon trends, statistical measures, or other status quo metrics associatedwith datasets from prior points in time. In some embodiments, thegenerated anomaly detection models may be associated with identifyinginstitutional abnormalities, such as potentially un-scrutinized,erroneous, inaccurate, or fraudulent resource transfers. In someembodiments, the generated anomaly detection models may be associatedwith identifying data records that were approved or otherwise promotedbut that may be determined to not have been sufficiently scrutinized.Further examples will be described herein.

In some embodiments, the processor 102 may be a microprocessor ormicrocontroller, a digital signal processing processor, an integratedcircuit, a field programmable gate array, a reconfigurable processor, orcombinations thereof.

The system 100 includes a communication circuit 104 configured totransmit or receive data messages to or from other computing devices, toaccess or connect to network resources, or to perform other computingapplications by connecting to a network (or multiple networks) capableof carrying data.

In some embodiments, the network 150 may include the Internet, Ethernet,plain old telephone service line, public switch telephone network,integrated services digital network, digital subscriber line, coaxialcable, fiber optics, satellite, mobile, wireless, SS7 signaling network,fixed line, local area network, wide area network, or other networks,including one or more combination of the networks. In some examples, thecommunication circuit 104 may include one or more busses, interconnects,wires, circuits, or other types of communication circuits. Thecommunication circuit 104 may provide an interface for communicatingdata between components of a single device or circuit.

The system 100 includes memory 106. The memory 106 may include one or acombination of computer memory, such as random-access memory, read-onlymemory, electro-optical memory, magneto-optical memory, erasableprogrammable read-only memory, and electrically-erasable programmableread-only memory, ferroelectric random-access memory, or the like. Insome embodiments, the memory 106 may be storage media, such as hard diskdrives, solid state drives, optical drives, or other types of memory.

The memory 106 may store an anomaly prediction application 112 includingprocessor-executable instructions that, when executed, configure theprocessor 102 to conduct operations disclosed in the present disclosure.In some embodiments, the anomaly prediction application 112 may includeoperations for generating one or more anomaly prediction models based onreceived volumes of datasets.

In some embodiments, datasets or data records may be configured as datamatrices, data formatted as comma separated values, or other datastructures. Respective data records may include at least one data valueassociated with a data type. To illustrate, an example dataset mayinclude a data matrix illustrated in Table 1 (below).

TABLE 1 Example Data Set JOURNAL Approval Create Date/ Approver ResourceJOURNAL ID Date/Time Time ID Amount Type DESCRIPTION 7330487 2018 Jul.29 2018 Jul. 29 313725020 10 CAD PTB WRITE 23:49:16-04:00 23:46:45-04:00OFF BELOW $50.00 7330487 2018 Jul. 29 2018 Jul. 29 313725020 −40 CAD PTBWRITE 23:49:16-04:00 23:46:45-04:00 OFF BELOW $50.00 7330487 2018 Jul.29 2018 Jul. 29 313725020 0.75 CAD PTB WRITE 23:49:16-04:0023:46:45-04:00 OFF BELOW $50.00 7004955 2017 Nov. 4 2017 Nov. 4543214225 −245335.0074 SGD IG 21:05:00+08:00 20:56:35+08:00 CORRECTION-OCT 2017 7004955 2017 Nov. 4 2017 Nov. 4 543214225 96493.29678 USD IG21:05:00+08:00 20:56:35+08:00 CORRECTION- OCT 2017

The dataset may include a plurality of data records (e.g., respectiverows) and may include a plurality of data types (e.g., respectivecolumns). The data types may include data such as journal entryidentification numbers, journal entry creation date/time, journal entryapproval date/time, journal entry approver identification number, aresource transfer amount, a currency type, a journal entry description,or other data types. The dataset in Table 1 is a simplified example forillustration only, and the dataset may include any number of dataentries or data records and may include any number of data types.

In some embodiments, the anomaly prediction application 112 may includeoperations for generating one or more meta attributes associated withrespective data records. Meta attributes associated with respective datarecords may be descriptive or representative of characteristicsassociated with respective data records individually or respective datarecords relative to other records in a dataset.

For example, the anomaly prediction application 112 may includeoperations for identifying a subset of data records that were approvedby a particular approver user (e.g., a department vice president havinga particular “Approver ID”), and determining the rate at which theparticular approver user approved a series of data records associatedwith resource transfers. In some scenarios, the anomaly predictionapplication 112 may include operations to identify one or more datarecords as being outliers or anomalous on the basis that the datarecords may not have been sufficiently scrutinized if the particularapprover user approved data records in a short duration of time.

Examples of meta attributes associated with data record characteristicsare illustrated in Table 2 (below).

TABLE 2 Example Data Entry Characteristics Meta Attribute Description ofAttribute Score Type Journal_approval_rate The rate at which a series ofjournal entries Continuous were approved. Divides the number of lines ina journal by Approve_Create_Time_Diff Approver_Reverse_Jp Percentage ofjournals associated with an Continuous approver that are auto-reversals,such as journal entries corrected after journal entry creation.Transit_median_amount Median absolute CAD amount for a particularContinuous organizational group combination Approve_Create_Time_Difftime difference between approval time and Continuous creation timeJournal_Create_IsWorkDay journal is created on a work day? booleanJournal_Create_IsWorkHour journal is created in work hours? (8 AM-7 PM)boolean Journal_Approve_IsWorkDay journal is approved on a work day?boolean Journal_Approve_IsWorkHour journal is approved in work hours? (8AM-7 PM) boolean Journal_isReverse journal is a reversed one? booleanJournal_has_NoDescr Indicates whether a journal entry may be booleanmissing a description Journal_hasFlagWord journal has flag words?, whereflag words may boolean include “clean”, “clear”, “fix”, “per”,“indicated”, “request”, “error”, “correct”, “fraud”, “none”, “N/A”,“NA”, “delete”, “unusual”, “mistake”, “incorrect”, “urgent”, “approve”,“review”, “write off”, “writeoff” Journal_isWriteOff journal iswriting-off? boolean Num_Line number of lines in a journal ContinuousCAD_AMOUNT the Canadian dollar amount in a line; where Continuous higherdollar value may be associated with relatively higher risk Type the typeof account; where particular types of boolean data entries or accountsmay be flagged as being suspicious Status the status of account (noisy);where a closed boolean account may be flagged as such, removing such anaccount from scrutiny IG is the account an intragroup one?; where anboolean intra-group account may be identified as such Account_AVE_AMOUNTthe average amount flowed in the account in this Continuous year; wherea higher dollar value may be associated with relatively higher riskAccount_MAX_AMOUNT the maximum amount flowed in the account inContinuous this year; where a higher dollar value may be associated withrelatively higher risk PP_SAME_Plf approver and creator are in the rollup unit? boolean APR_SAME_Plf approver belongs to the same roll up unitof the boolean journal line? CRT_SAME_Plf creator belongs to the sameroll up unit of the boolean journal line? APR_Status status of theapprover (noisy) boolean CRT_Status status of the creator (noisy)boolean MisCreator cannot find creator HR information? (noisy) booleanMisApprover cannot find approver HR information? (noisy) booleanApprover_Days how many days the approver works on the Continuous manualjournal entry (MJE); where the score may indicate entry approvers havingworked relatively few or relatively large number of days Creator_Dayshow many days the creator works on MJE; Continuous where the score mayindicate entry approvers having worked relatively few or relativelylarge number of days Creator_higherSenior creator level higher thanPL07? boolean Approver_higherSenior approver level higher than PL07?boolean Creator_higherThan_Approver creator level than approver level?boolean Approver_isWorkHour_Jp percentage of journals approved outsidework Continuous hours by this approver; where entry approvers workingoutside of normal business hours may be associated with greater risk oferror Approver_isWorkDay_Jp percentage of journals approved outside workContinuous days by this approver Approver_Reverse_Jp percentage ofreversed journals approved by Continuous this approverApprover_FlagWords_Jp percentage of journals containing flag wordsContinuous approved out of work hour by this approverApprover_WriteOff_Jp percentage of write-off journals approved out ofContinuous work hour by this approver Approver_AVE_AMOUNT average dollaramount approved in this year; Continuous where a higher dollar value maybe associated with relatively higher risk Approver_MAX_AMOUNT maximumdollar amount approved in this year; Continuous where a higher dollarvalue may be associated with relatively higher riskCreator_isWorkHour_Jp percentage of journals created outside workContinuous hours by this creator Creator_isWorkDay_Jp percentage ofjournals created outside work Continuous days by this creatorCreator_Reverse_Jp percentage of reversed journals created by thisContinuous creator Creator_FlagWords_Jp percentage of journalscontaining flag words Continuous created out of work hour by thiscreator Creator_WriteOff_Jp percentage of write-off journals created outof Continuous work hour by this creator Creator_AVE_AMOUNT averagedollar amount created in this year; Continuous where a higher dollarvalue may be associated with relatively higher risk Creator_MAX_AMOUNTmaximum dollar amount created in this year; Continuous where a higherdollar value may be associated with relatively higher riskEXE_AVE_AMOUNT percentage of amounts that exceed the average Continuousamounts for that GL account, how close this transaction is to theaccount's average COV_MAX_AMOUNT percentage of amounts that cover themaximum Continuous amounts for that GL account, how close thistransaction is to the account's maximum

In some embodiments, the anomaly prediction application 112 may includeoperations of monitoring for anomalous data records in a plurality ofdata records, and of identifying potentially outlier or anomalous datarecords, thereby indicating that subsequent data process operations maybe warranted. For example, where a data record may be flagged as beingpotentially an outlier or anomalous, the system 100 may be configured toconduct subsequent data process operations for further scrutinizing thedata record prior to proceeding with approval or promotion processes.

The system 100 includes data storage 114. In some embodiments, the datastorage 114 may be a secure data store. In some embodiments, the datastorage 114 may store one or more data records received from the datasource device 160. For example, the data storage 114 may store aplurality of data records representing manual journal entries associatedwith the past 3 months.

In some embodiments, the data storage 114 may store one or more metaattributes or metrics/scores associated with the respective metaattributes of the plurality of data records. In some examples, themetrics/scores associated with meta attributes may be binary scores,thereby having a value of 0 (e.g., indicating low chance of being anoutlier/anomaly) or having a value of 1 (e.g., indicating a higherchance of being an outlier/anomaly). In some examples, themetrics/scores associated with meta attributes may be continuous scores,thereby having values that may range between 0 and 1. With continuousscores, values nearer to a value of 1 may be associated with higherchance of being an outlier/anomaly).

In some embodiments, metrics/scores associated with meta attributes ofdata records may be configured as anomalous ascending metrics, such thatwhen the system 100 determines that the metric or score increases invalue, the chance of that data record being an outlier or anomalous datarecord increases relative to a subset or population of related datarecords.

In some embodiments, metrics/scores associated with meta attributes ofdata records may be continuous scores, whereby the metrics/scores mayhave values ranging between 0 and 1. Metrics/scores that approach avalue of 1 may indicate that the data record has an increased likelihoodof being an anomalous data record.

As will be described with reference to some embodiments in the presentdisclosure, the system 100 may conduct operations to monitor one or moredata records for identifying outlier or anomalous data records that maywarrant subsequent data processes thereon. The monitoring of datarecords may be based on detection models defined, at least in part, by aplurality of score distribution representations generated based ondatasets.

The client device 130 may be a computing device, such as a mobilesmartphone device, a tablet device, a personal computer device, or athin-client device. The client device 130 may be configured to transmitmessages to/from the system 100 for querying data records associatedwith one or more meta attributes. As will be disclosed in examples ofthe present disclosure, the one or more meta attributes may beassociated with characteristics of the particular data recordindividually or of the particular data record relative to other datarecords in a plurality of data records.

The client device 130 may include a processor, a memory, or acommunication circuit, similar to the example processor, memory, orcommunication circuit of the system 100. In some embodiments, the clientdevice 130 may be a computing device associated with a local areanetwork. The client device 130 may be connected to the local areanetwork and may transmit one or more data sets or signals to the system100.

The data source device 160 may be a computing device, such as dataservers, database devices, or other data storing systems associated withresource transaction entities. Continuing with examples disclosedherein, the data source device 160 may be associated with a bankinginstitution. The data source device 160 may include one or more of ageneral ledger, journal entry systems, human resource data systems,finance data servers for foreign exchange rates, or the like. Journalentries may be data records for capturing resource transfers betweenaccounts or parties.

In some examples, journal entries may represent transfer of monetaryresources from one account to another account. In some examples, journalentries may represent an expense report allowing an employee user toseek reimbursement from an employer user for expenses that were incurredby the employee on behalf of the employer. In some examples, journalentries may represent transfer of property from one user to anotheruser. In some scenarios, prior to completing resource transferscontemplated by journal entries, such journal entries may be subject toscrutiny or approval by an approver user. An approver user may beassociated with a client device 130, and may review journal entriesidentified as requiring scrutiny by that approver user. Once theapprover user agrees that the journal entry is acceptable, the clientdevice 130 may receive an indication (e.g., via a user interface) thatthe journal entry is acceptable, and transmit the approval indicator tothe system 100. The journal entry may then be finalized.

Because journal entry approvals may include discretionary input from anapprover user, it may be beneficial to provide systems and methods ofmonitoring for anomalous data records for identifying data records thatmay be deemed to be outliers based on datasets associated with priorpoints in time. Examples of outlier data records may include series ofdata records identified to have been deemed to be acceptable by a givenapprover user in a short period of time (e.g., 500 journal entriesidentified via a client device by an approver user as being acceptablewithin the span of 5 minutes). In another example, outlier data recordsmay include data records having journal description text havingparticular words or terms, such as fraud, error, write-off, among otherexamples. In another example, outlier data records may include datarecords recording a resource value that may differ from a median (orother quantitative measure) amount for a particular group of datarecords (e.g., data records of a particular department at the bankinginstitution).

In some embodiments, the system 100 may conduct operations to generateanomaly detection models for generating predictions on whetherrespective data records may warrant subsequent data processing. Forexample, the anomaly detection models may be configured to identify datarecords that may be outlier data records relative to data records in apopulation. When outlier data records may be identified, the system 100may be configured to conduct operations for determining whether theidentified data record adhere to defined criteria.

As disclosed herein, in some embodiments, the system 100 may generateone or more meta attributes associated with data records. For example,meta attributes may be scores or metrics that are descriptive orrepresentative of characteristics associated with respective datarecords: (a) individually; or (b) relative to a plurality of datarecords in a dataset.

In some embodiments, the system 100 may generate one or more modelsassociated with distributions of respective meta attributes for aplurality of data records in a dataset. To illustrate examples,reference will be made to FIGS. 2A, 2B, 3A, 3B, 4A, and 4B.

FIG. 2A illustrates a graphical plot 200A associated a data attributecorresponding to a plurality of data records. As a non-limiting example,the data attribute may be associated with values that may range from 0to 6. In FIG. 2A, the graphical plot 200A may illustrate a proportion(or density) of data records having a metric value along the range ofmetric values. In some embodiments, the system 100 may generate one ormore models based on the metric distribution representation illustratedin FIG. 2A, such that outlier or anomalous data records may exhibit dataattributes having a metric described as “right skew”, or on the “right”side of the metric distribution representation.

FIG. 2B illustrates a graphical plot 200B of a metric distributionrepresentation with a greater number of identified outlier or anomalousdata records. In FIG. 2B, a median value of the plurality of identifiedanomalous data records is illustrated by a graphical indicator 210.

To transform the metric distribution representation to a score, thesystem 100 (FIG. 1 ) may be configured to transform the distributionrepresentation to a predefined scale based on normalizing operations. Insome embodiments, operations for minimum-maximum scaling may beconducted based on the following relationship:min_max_metric=(metric−min(metric))/(max(metric)−min(metric))The above operations of minimum-maximum scaling may bias the metricdistribution to a scale between values of 0 and 1.

To illustrate, reference is made to FIG. 3A, which illustrates a scoredistribution representation 300A corresponding to a meta attribute for aplurality of data records. In FIG. 3A, the score distributionrepresentation 300A illustrates a density plot of meta attribute scoresfrom values 0 to 1. However, in the score distribution representation300A, meta attribute scores associated with outlier data records maycause a maximum value for the minimum-maximum scaling calculation todominate other meta attribute scores.

To illustrate the dominating impact to the score distributionrepresentation 300A, reference is made to FIG. 3B, which illustrates ascore distribution representation 300B having meta attribute scoresassociated with outlier data records omitted. However, an anomalydetection model based on the score distribution representation 300B ofFIG. 3B may not correspond to an accurate model for identifyinganomalous data records.

In some embodiments, the system 100 may conduct operations for applyinga log transformation based on the relationship:log_metric=log(metric+1)thereby minimizing impact of meta attribute scores associated withoutlier data records. To illustrate, reference is made to FIG. 4A, whichillustrates a metric distribution representation 400A based on theexample logarithmic transformation disclosed above. The metricdistribution representation 400A may be a plot of meta attribute metricvalues associated with a plurality of data records, including outlierdata records.

FIG. 4B illustrates a score distribution representation 400B based onthe metric distribution representation 400A illustrated in FIG. 4A. Thesystem 100 may conduct operations to generate the score distributionrepresentation 400B based on a minimum-maximum scaling normalizationoperation. In some embodiments, the normalization operation may be basedon the following relationship:min_max_metric=(metric−min(metric))/(max(metric)−min(metric))

In the example illustrated in FIG. 4B, the score distributionrepresentation 400B may be based on meta attribute values associatedwith outlier data records without having a dominating impact on thescore distribution representation.

Data records that may be identified as being extreme outliers (e.g.,having a meta attribute metric or score that deviates greatly from acentral tendency of other meta attribute metric or score) may have adominating effect on the distribution representations when the datarecords identified as being extreme outliers may make the scores ofother data records less relevant. In some scenarios, without applyingthe example logarithmic transformation to distribution representationshaving at least one data record identified as being an extreme outlier,the distribution representation may not be representative of a requiredanomaly prediction model. That is, without the example logarithmictransformation, data records that may be non-extreme outliers may not beidentified as such at least because data records corresponding toextreme outliers may skew the detection model to minimize identificationof the non-extreme outliers.

In some embodiments, meta attributes associated with data records maytake on a value that may be between a negative value and a positivevalue. In such scenarios, a logarithmic transformation for minimizingimpact of meta attribute scores associated with outlier data records maybe defined by the following relationship:log_metric=log(metric+abs(min(metric))+1)

Reference is made to FIG. 5 , which illustrates a score distributionrepresentation 500, in accordance with another embodiment of the presentapplication. In some embodiments, the system 100 (FIG. 1 ) may conductoperations to generate an anomaly detection model based on the scoredistribution representation 500.

For example, the score distribution representation 500 may correspond toa distribution of normalized meta attribute metric values associatedwith a plurality of data records. The density associated with quantityof data records having respective meta attribute scores may beconsidered for generating the anomaly detection model to define outlieror anomaly categories.

In some embodiments, an anomaly prediction application 112 (FIG. 1 ) ofFIG. 1 may include operations to identify quantile reference pointsassociated with the score distribution representation 500. For instance,quantiles may be a set of values of a variate which may divide the scoredistribution representation 500 into groups, each group including afraction of a dataset.

As an illustrating example, if a 25th percent quantile is estimated, thesystem 100 may expect that 25% of score values would be lesser than thisvalue, and that 75% of score values would be greater than this value.

In another example, a quartile may be a quantile that divides associatedmeta attribute scores into quarters. For example, 25th, 50th, 75thpercent quantiles may be referred to as the first (Q1), second (Q2), andthird quartiles (Q3), respectively.

In some embodiments, the system 100 may generate an anomaly detectionmodel based on an inter-quartile range (IQR) defined as Q3−Q1. Thesystem 100 may determine that an upper anomaly category be defined by anoutlier threshold defined by Q3+C*IQR, where C is a threshold factor.

In FIG. 5 , the upper anomaly category may be based on a thresholdfactor (C) having a value of 1.5, and the upper anomaly category may beprovided by: Q3+1.5*IQR.

In FIG. 5 , the quantile thresholds Q1, Q3, and Q3+1.5*IQR may beassociated with the score distribution representation 500 to provide ananomaly detection model for determining whether subsequent processing ofa given data record associated with a meta attribute may be warranted.For example, a data record having a meta attribute score that is greaterthan the upper anomaly category threshold may be considered “high”anomaly. That data record may be identified by the system 100 forsubsequent processing, such that the data record may be furtherscrutinized for adherence to defined criteria.

In some embodiments, the system 100 may determine one or more thresholdfactors (C) based on a plurality of datasets associated with priorpoints in time. In some embodiments, the threshold factor (C) may be adynamically tunable parameter, and the system 100 may conduct operationsfor determining a threshold factor (C) for a given score representationdistribution, thereby setting one or more boundaries for identifying adesired quantity of outlier data records. For example, the thresholdfactor (C) may be dynamically altered based on the time of year (e.g.,year-end requirement to identify outliers having particular metaattributes) or based on capacity to conduct further data operationprocesses (e.g., increase in cloud computing resources, thereby thesystem being able to handle more audits of data record outliers). Otherexample scenarios that may lead to dynamically tuning the thresholdparameter may be contemplated.

Quantile reference points are described herein as an illustratingexample; however, it may be contemplated that the anomaly predictionapplication 112 may include other operations to identify thresholdreference points associated with the score distribution representation500 based on non-parametric, unsupervised outlier detection. That is,operations for determining reference points for modelling outlierthreshold categories for score distribution representations may notdepend on data distributions or may not depend on labelled data.

Data records may be associated with one or more meta attributes foridentifying characteristics of the data record individually or relativeto other data records. Example meta attributes may include acharacteristic of the data record (e.g., approval rate relative to otherdata records, whether the data record includes one or more flag words,absolute resource transfer value, etc.). Accordingly, the system 100 maybe configured to conduct operations generating anomaly detection modelsto provide an interim anomaly measure corresponding to each metaattributes.

In response to determining a plurality of interim anomaly measurescorresponding to a plurality of meta attributes for a data record, thesystem 100 may be configured to determine an anomaly prediction based ona combination of the plurality of interim anomaly measures associatedwith respective meta attributes associated with the data record. Theanomaly prediction may be based on a composite score by combining theplurality of interim anomaly measures. In scenarios where at least oneinterim anomaly measure (corresponding to a meta attribute) indicatesthat the data record may be an anomalous data record, the overallanomaly prediction may indicate that the data record is an anomaly oroutlier.

In some embodiments, the combination of the plurality of interim anomalymeasures may include a weighted summation of the plurality of interimanomaly measures. The following are example weight factors associatedwith a list of meta attributes corresponding to data records:

Example Meta Attribute Description Weight Factor Score_ABS_CAD_AmountCanadian dollar value associated with a 1 data record or journal entryScore_Approver_FlagWords_JP Data record or journal entry associated 1with a journal approver that contain flag wordsScore_Approver_Reverse_Jp Data record or journal entry associated 0.25with a creator that are auto-reversals Score_journal_approval_rate Ratethat a data record or series of data 3 records were approvedScore_journal_desc_flag_word Binary score indicating whether or not a0.5 data record or journal entry description contains a flag word

In the examples listed above, the “scorejournal_approval_rate” metaattribute is associated with a weight factor (e.g., “3”) greater thanthe “score_approver_reverse” meta attribute, thereby indicating that thedetection model may determine that data records (e.g., manual journalentries) that may be approved relatively quickly pose a larger concernto data integrity than data records that may be corrected following datarecord creation. The example weight factors illustrated above are forease of exposition and illustration, and other weight factors associatedwith meta attributes corresponding to data records may be contemplated.

In some embodiments, the combination of interim anomaly measures may bebased on a mathematical combination. In embodiments where the interimanomaly measures are numerical scores, the overall anomaly predictionmay be based on a summation of the respective interim anomaly measures.In some embodiments, the overall anomaly prediction may be based on aweighted combination of the respective interim anomaly measures.

In some embodiments, the overall anomaly prediction may be a numericalscore, may be a category indicator (e.g., high anomaly, medium anomaly,non-anomaly), or other categorical measure for providing an indicationon whether subsequent processing of the data record is warranted.

Reference is made to FIG. 6 , which illustrates a method 600 ofmonitoring for anomalous data records in a plurality of data records, inaccordance with an embodiment of the present disclosure. The method 600may be conducted by the processor 102 of the system 100 (FIG. 1 ).Processor-executable instructions may be stored in the memory 106 andmay be associated with the anomaly prediction application 112 or otherprocessor-executable applications not explicitly illustrated in FIG. 1 .The method 600 may include operations such as data retrievals, datamanipulations, data storage, or other operations, and may includecomputer-executable operations.

For ease of exposition, the method 600 may be described with referenceto an example banking institution system configured to monitor foranomalous data records. Data records being monitored may include examplemanual journal entries described in earlier examples. Manual journalentries may be for tracking resource transfers. In some embodiments,manual journal entries may be for other types of records.

In some embodiments, respective manual journal entries may be associatedwith meta attributes, which may be representative of characteristics ofdata records individually or relative to other data records in adataset. As an example, a meta attribute may represent a rate at which aseries of journal entries (including the given journal entry) may havebeen approved by an approver user. In another example, a meta attributemay represent whether the journal entry includes descriptive text havingflag words that may suggest a potential anomalous data record. Inanother example, a meta attribute may represent whether the givenjournal entry has been revised or corrected since journal entrycreation.

In some scenarios, manual journal entries may need to be approved orotherwise scrutinized by an approver user (associated with a clientdevice) prior to being promoted or advanced to a subsequent resourcetransfer process. In scenarios where the approver user may notappropriately scrutinize a journal entry, it may be beneficial toprovide methods of monitoring for anomalous data records, therebyincreasing a chance or confidence that approval of manual journalentries adhere to policies associated with accuracy, completeness, orother factors.

At operation 602, the processor may receive a data record associatedwith one or more meta attributes to determine whether subsequentprocessing of the data record may be warranted. For example, theprocessor may conduct operation 602 subsequent to an approver user (viaa client device 130) having approved a data record (e.g., journalentry).

In some embodiments, the data record may be among a plurality of datarecords of a dataset. In some embodiments, the dataset may be providedas a data matrix, and the data record may be a row of the data matrix.

In some embodiments, the respective data records may be associated withone or more meta attributes, such as whether the journal entry includesdefined “flag words” within descriptive text, resource value associatedwith the journal entry, the rate of approval of the journal entry amonga group of other journal entries, among other examples. In somescenarios, the processor may determine, based on associated metaattributes, whether subsequent processing (e.g., data scrutiny) of thedata record may be warranted.

In some embodiments, the processor may determine meta attribute valuesbased on a combination of a plurality of data records associated with aprior point in time. For example, the meta attribute value may representthe rate at which a given data record in combination with one or moreother data records were approved by an approver user. If the approveruser is detected to have approved several data records within 5 seconds,the processor may conduct operations for inferring that the approveruser may not have spent sufficient time to read or scrutinize the datarecord associated with a resource transfer.

At operation 604, the processor may generate an anomaly prediction forthe data record based on a detection model and the at least one metaattribute associated with the data record. The detection model may bedefined by a plurality of score distribution representations based onquantile bins and a dynamic quantile weight. The anomaly prediction maybe based on one or a plurality of meta attributes associated with thedata record.

In some embodiments, the plurality of score distribution representationsmay respectively correspond to a meta attribute associated with the datarecord. For example, the respective score distribution representationsmay be for generating a model for identifying one or more categories ofanomaly predictions (e.g., high outlier, medium outlier, non-outlier,etc.) based on the specific meta attribute. In some embodiments, therespective score distribution representations may be for generating amodel to provide an interim anomaly measure. Thus, a combination of theplurality of interim anomaly measures (e.g., associated with respectivemeta attributes) may be for generating the anomaly prediction for thedata record.

In some embodiments, the combination of the plurality of interim anomalymeasures associated with the respective meta attributes may include aweighted combination of the respective interim anomaly measures. Theweighted combination may correspond to relative importance of respectivemeta attributes.

In some embodiments, the dynamic quantile weight may be a thresholdfactor for configuring a threshold value corresponding to identifying ananomalous data record. The threshold factor (e.g., disclosed withreference to FIG. 5 ) may be based on a plurality of data recordsassociated with a prior point in time. For example, the threshold factormay be a variable that determines an approximate quantity of datarecords that the system may identify as an outlier data record based onhistorical analysis of quantity of outliers.

In some embodiments, the quantile bins may be defined based on quartilesof the respective score distribution representations. In someembodiments, the processor may identify that a data record is anomalousbased on a quantile bin defined by a threshold determined using aweighted inter-quartile range value (e.g., disclosed with reference toFIG. 5 ).

In some scenarios, a generated anomaly prediction may indicate that adata record may be a strong outlier, a mild outlier, or a non-outlier.In some embodiments, the generated anomaly prediction may be a numericalindication of whether the data record may be an anomaly relative to aplurality of data records in a dataset. Other anomaly identificationcategorizations may be contemplated.

At operation 606, the processor may transmit a signal representing theanomaly prediction for presentation at a user device 130 (FIG. 1 ). Thesignal representing the anomaly prediction may be for identifying one ormore data records for subsequent data processes. In some embodiments, ananomaly prediction indicating that a data record may be a “high anomaly”may communicate to a client device 130 (FIG. 1 ) that the data recordmay require further scrutiny prior to causing effect to a resourcetransfer associated with the data record.

For example, a data record representing a manual journal entry may havea data attribute indicating that the data record includes “flag words”,such as “unusual” or “urgent”. In the present example, such data recordsassociated with such flag words that have nonetheless been approved byan approver user may warrant further scrutiny, at least because theapprover user may have overlooked the contents of the data record. Insome embodiments, the processor may conduct further data processoperations for further scrutinizing the data record prior to effecting aresource transfer (e.g., journal entry for a resource transfer).

In some embodiments, the signal representing the anomaly prediction maybe for generating a user interface for display at the system 100 or at aclient device 130 in communication with the system 100. For example, theprocessor may generate a graphical user interface based on the signalrepresenting the anomaly prediction for displaying an aggregate anomalyprediction for the plurality of data records.

Reference is made to FIG. 7 , which illustrates a user interface 700configured to display summary data, in accordance with embodiments ofthe present disclosure. In some embodiments, the user interface 700 maybe dynamically generated to include or to filter anomaly predictionsassociated with particular characteristics. For example, the userinterface 700 may be based on dates that data records were created,based on resource transfer quantity (e.g., transaction quantity in CADor US dollars), based on data record identification numbers, or othercriteria.

In some embodiments, the user interface 700 may be regenerated on aperiodic basis based on subsequently generated outlier criteriaassociated with subsequent time periods. For example, the user interface700 may be generated based on evolving data trends, data averages, orchanges to status quo metrics. In some embodiments, the user interface700 may be updated based on revisions to dynamic quantile weightsassociated with detection models described in the present disclosure.

In some embodiments, the processor may determine that one or a group ofdata records may be identified as potentially anomalous, and theprocessor may transmit a message to a client device 130 to requestfurther explanation or rationale from a user for creation or approval ofthe data records being identified as potentially anomalous.

In some scenarios, the system of monitoring for anomalous data recordsmay, on a recurring basis, identify data records having particular metaattributes as being an anomaly or outlier. For example, the system may,on a recurring basis, identify a plurality of data records approved by aparticular user approver (e.g., Jill) as being an anomaly or outlier.These plurality of data records may have been approved during late hoursin a day (e.g., at 2 am local time), and the system may be configured toidentify such data record approvals as potential anomalies, when inreality the data records may have a valid reason for being routinelyapproved during late hours in a day. For instance, Jill may be workingon a “flexible” arrangement where Jill works on an alternate schedule.

It may be beneficial to provide systems for correcting potential bias,or revising criteria that may be explainable, when monitoring foranomalous data records. Meta attributes associated with time-basedidentification of outlier data records (e.g., example above) is anexample, and other meta attributes for identifying potential detectionmodel bias may be contemplated.

In some embodiments, the processor may determine that a plurality ofdata records associated with at least one of a particular user or aparticular subgroup associated with a meta attribute value areidentified as outlier data records for indicating biased identificationof data records. The processor may, subsequently, generate one or moreupdated score distribution representations to minimize identified biasamong anomaly predictions.

In scenarios where the system may identify a large percentage of datarecords as being outliers, the processor may dynamically vary athreshold factor (see example disclosed with reference to FIG. 5 ). Insome other embodiments, the processor may generate updated scoredistribution representations for providing updated detection models. Theupdated detection models may reflect altering trends that alter whatdata records in a dataset population may represent outlier or anomalies.

The term “connected” or “coupled to” may include both direct coupling(in which two elements that are coupled to each other contact eachother) and indirect coupling (in which at least one additional elementis located between the two elements).

Although the embodiments have been described in detail, it should beunderstood that various changes, substitutions and alterations can bemade herein without departing from the scope. Moreover, the scope of thepresent application is not intended to be limited to the particularembodiments of the process, machine, manufacture, composition of matter,means, methods and steps described in the specification.

As one of ordinary skill in the art will readily appreciate from thedisclosure, processes, machines, manufacture, compositions of matter,means, methods, or steps, presently existing or later to be developed,that perform substantially the same function or achieve substantiallythe same result as the corresponding embodiments described herein may beutilized. Accordingly, the appended claims are intended to includewithin their scope such processes, machines, manufacture, compositionsof matter, means, methods, or steps.

The description provides many example embodiments of the inventivesubject matter. Although each embodiment represents a single combinationof inventive elements, the inventive subject matter is considered toinclude all possible combinations of the disclosed elements. Thus if oneembodiment comprises elements A, B, and C, and a second embodimentcomprises elements B and D, then the inventive subject matter is alsoconsidered to include other remaining combinations of A, B, C, or D,even if not explicitly disclosed.

The embodiments of the devices, systems and methods described herein maybe implemented in a combination of both hardware and software. Theseembodiments may be implemented on programmable computers, each computerincluding at least one processor, a data storage system (includingvolatile memory or non-volatile memory or other data storage elements ora combination thereof), and at least one communication interface.

Program code is applied to input data to perform the functions describedherein and to generate output information. The output information isapplied to one or more output devices. In some embodiments, thecommunication interface may be a network communication interface. Inembodiments in which elements may be combined, the communicationinterface may be a software communication interface, such as those forinter-process communication. In still other embodiments, there may be acombination of communication interfaces implemented as hardware,software, and combination thereof.

Throughout the foregoing discussion, numerous references will be maderegarding servers, services, interfaces, portals, platforms, or othersystems formed from computing devices. It should be appreciated that theuse of such terms is deemed to represent one or more computing deviceshaving at least one processor configured to execute softwareinstructions stored on a computer readable tangible, non-transitorymedium. For example, a server can include one or more computersoperating as a web server, database server, or other type of computerserver in a manner to fulfill described roles, responsibilities, orfunctions.

The technical solution of embodiments may be in the form of a softwareproduct. The software product may be stored in a non-volatile ornon-transitory storage medium, which can be a compact disk read-onlymemory (CD-ROM), a USB flash disk, or a removable hard disk. Thesoftware product includes a number of instructions that enable acomputer device (personal computer, server, or network device) toexecute the methods provided by the embodiments.

The embodiments described herein are implemented by physical computerhardware, including computing devices, servers, receivers, transmitters,processors, memory, displays, and networks. The embodiments describedherein provide useful physical machines and particularly configuredcomputer hardware arrangements.

As can be understood, the examples described above and illustrated areintended to be exemplary only.

Applicant notes that the described embodiments and examples areillustrative and non-limiting. Practical implementation of the featuresmay incorporate a combination of some or all of the aspects, andfeatures described herein should not be taken as indications of futureor existing product plans. Applicant partakes in both foundational andapplied research, and in some cases, the features described aredeveloped on an exploratory basis.

What is claimed is:
 1. A system of monitoring for anomalous data recordsin a plurality of data records comprising: a processor; and a memorycoupled to the processor and storing processor-executable instructionsthat, when executed, configure the processor to: receive an electronicapproval signal associated with a data record defining a resourcetransfer data process, the data record associated with at least one metaattribute to determine whether a subsequent electronic approvaloperation for the data process is warranted, wherein the electronicapproval signal triggers promotion of the resource transfer data processto be executed by the processor; generate an anomaly prediction for theelectronic approval signal based on a detection model and the at leastone meta attribute, the detection model defined by a plurality of scoredistribution representations based on quantile bins and a dynamicquantile weight tunable over time, the detection model generating aninterim anomaly measure corresponding to respective score distributionrepresentations, wherein the anomaly prediction is generated based on acombination of interim anomaly measures associated with respective metaattributes; generate a subsequent electronic approval operation for thedata record based on the anomaly prediction prior to executing, by theprocessor, the defined resource transfer data process; and transmit asignal representing the anomaly prediction for presentation at a userdevice for identifying one or more data processes for the subsequentelectronic approval operation.
 2. The system of claim 1, wherein thecombination of interim anomaly measures associated with the respectivemeta attributes includes a weighted combination of the respectiveinterim anomaly measures, wherein the weighted combination correspondsto relative importance of respective meta attributes.
 3. The system ofclaim 1, wherein the dynamic quantile weight includes a threshold factorfor configuring a threshold value corresponding to identifying ananomalous electronic approval signal, and wherein the threshold factoris based on a plurality of electronic approval signals associated with aprior point in time.
 4. The system of claim 1, wherein the processor isconfigured to: determine that a plurality of electronic approval signalsassociated with at least one of a particular user identifier or aparticular subgroup associated with a meta attribute value areidentified as outlier electronic approval signals for indicating biasedidentification of data processes; and generating one or more updatedscore distribution representations to minimize identified bias amonganomaly predictions.
 5. The system of claim 1, wherein the processor isconfigured to determine the meta attribute based on a combination of aplurality of electronic approval signals associated with a useridentifier.
 6. The system of claim 5, wherein the meta attributerepresents a rate of received electronic approval signals associatedwith the user identifier.
 7. The system of claim 4, wherein theprocessor is configured to determine the meta attribute value based on acombination of a plurality of electronic approval signals associatedwith a prior point in time.
 8. The system of claim 1, wherein thequantile bins are based on quartiles of the respective scoredistribution representations, and wherein an anomalous electronicapproval signal is associated with a quantile bin based on a weightedinter-quartile range value.
 9. The system of claim 1, wherein theplurality of score distribution representations are respectively basedon a logarithmic transformation of metric distribution representationsassociated with respective meta attributes.
 10. The system of claim 1,wherein the processor is configured to: identify a plurality ofelectronic approval signals; and generate a graphical user interfacebased on the signal representing the anomaly prediction for displayingan aggregate anomaly prediction for the plurality of electronic approvalsignals associated with respective data records.
 11. A method ofmonitoring for anomalous data records in a plurality of data recordscomprising: receiving an electronic approval signal associated with adata record defining a resource transfer data process, the data recordassociated with at least one meta attribute to determine whether asubsequent electronic approval operation for the data process iswarranted, wherein the electronic approval signal triggers promotion ofthe resource transfer data process to be executed by the processor;generating an anomaly prediction for the electronic approval signalbased on a detection model and the at least one meta attribute, thedetection model defined by a plurality of score distributionrepresentations based on quantile bins and a dynamic quantile weighttunable over time, the detection model generating an interim anomalymeasure corresponding to respective score distribution representations,wherein the anomaly prediction is generated based on a combination ofinterim anomaly measures associated with respective meta attributes;generating a subsequent electronic approval operation for the datarecord based on the anomaly prediction prior to executing, by theprocessor, the defined resource transfer data process; and transmittinga signal representing the anomaly prediction for presentation at a userdevice for identifying one or more data processes for the subsequentelectronic approval operation.
 12. The method of claim 11, wherein thecombination of interim anomaly measures associated with the respectivemeta attributes includes a weighted combination of the respectiveinterim anomaly measures, wherein the weighted combination correspondsto relative importance of respective meta attributes.
 13. The method ofclaim 11, wherein the dynamic quantile weight includes a thresholdfactor for configuring a threshold value corresponding to identifying ananomalous electronic approval signal, and wherein the threshold factoris based on a plurality of electronic approval signals associated with aprior point in time.
 14. The method of claim 11, comprising: determinethat a plurality of electronic approval signals associated with at leastone of a particular user identifier or a particular subgroup associatedwith a meta attribute value are identified as outlier electronicapproval signals for indicating biased identification of data processes;and generating one or more updated score distribution representations tominimize identified bias among anomaly predictions.
 15. The method ofclaim 11, comprising: determining the meta attribute based on acombination of a plurality of electronic approval signals associatedwith a user identifier.
 16. The method of claim 15, wherein the metaattribute include& represents a rate of received electronic approvalsignals associated with the user identifier.
 17. The method of claim 14,comprising determining the meta attribute value based on a combinationof a plurality of electronic approval signals associated with a priorpoint in time.
 18. The method of claim 11, wherein the quantile bins arebased on quartiles of the respective score distribution representations,and wherein an anomalous electronic approval signal is associated with aquantile bin based on a weighted inter-quartile range value.
 19. Themethod of claim 11, wherein the plurality of score distributionrepresentations are respectively based on a logarithmic transformationof metric distribution representations associated with respective metaattributes.
 20. A non-transitory computer-readable medium or mediahaving stored thereon machine interpretable instructions which, whenexecuted by a processor, cause the processor to perform acomputer-implemented method of monitoring for anomalous data records ina plurality of data records, the method comprising: receiving anelectronic approval signal associated with a data record defining aresource transfer data process, the data record associated with havingat least one meta attribute to determine whether a subsequent electronicapproval operation for the data process is warranted, wherein theelectronic approval signal triggers promotion of the resource transferdata process to be executed by the processor; generating an anomalyprediction for the electronic approval signal based on a detection modeland the at least one meta attribute, the detection model defined by aplurality of score distribution representations based on quantile binsand a dynamic quantile weight tunable over time, the detection modelgenerating an interim anomaly measure corresponding to respective scoredistribution representations, wherein the anomaly prediction isgenerated based on a combination of interim anomaly measures associatedwith respective meta attributes; generating a subsequent electronicapproval operation for the data record based on the anomaly predictionprior to executing, by the processor, the defined resource transfer dataprocess; and transmitting a signal representing the anomaly predictionfor presentation at a user device for identifying one or more dataprocesses for the subsequent electronic approval operation.